SQL Injection in SQL::Abstract before 2.000001_04
SQL::Abstract versions 1.90_01 to before 2.000001_04 for Perl skip the injection_guard check when function names are passed with -func. An attacker can trigger SQL injection by supplying an untrusted function name via the -func option in a query. Applications using vulnerable versions are affected.
What to do: Upgrade SQL::Abstract to 2.000001_04. No workaround given.
| Product | Affected | Fixed in |
|---|---|---|
| Perl SQL::Abstract | 1.90_01 before 2.000001_04 | 2.000001_04 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func. injection_guard is documented to apply to every function name, but only the { -name => ... } shorthand goes through it. The explicit { -func => [ $name, ... ] } form puts $name into the SQL unchecked. An application that relies on injection_guard to reject an untrusted function name passed with -func allows SQL injection.
Versions before 2.000001_04 allow SQL injection via where values in identifier position and XSS via unescaped SQL text and bind values.
Today 1.5K readers · 2.4K views · 768 reads · all time 189K views